US20080120191A1 - Remote display tamper detection using data integrity operations - Google Patents

Abstract

Methods and systems for detecting tampering of a remote display. According to one method, a first data integrity result is generated by performing a first data integrity operation on display data to be displayed on the remote display at a secure module. The display data is transmitted from the secure module to the remote display security module. The remote display security module receives the display data. A second data integrity result is generated by performing the first data integrity operation on the display data received at the remote display security module. A determination is made as to whether the remote display has been tampered with at the secure module if the first data integrity result does not match the second data integrity result.

Description

FIELD OF THE INVENTION
• The present invention relates to a system and method for tamper detection of a remote display using data integrity operations.
BACKGROUND OF THE INVENTION
• Fuel dispensers dispense petroleum and alternative fuel products at retail service stations and convenience store operations around the world. Fuel dispensers have user interfaces, including displays and keypads, for effecting customer payment transactions. These user interfaces include credit/debit card magnetic readers for retrieving account information from the customer. Other point of sale (POS) terminals also include similar user interfaces.
• These user interfaces, and in particular fuel dispenser interfaces accessible outside to the public, have become subject to attack by individuals desiring to acquire account information from customers. Display interfaces may be hacked to present false prompts to customers on the user interface in order to acquire this account information. When customers respond to these false prompts, their account information may be commandeered and used improperly and fraudulently.
• This potential for tampering has resulted in certain physical security measures being adopted for fuel dispenser user interfaces. These physical security measures include mounting the display within a secure enclosure with the display controller. Alternatively, the display has been mounted to a secure enclosure and the display controller has been placed within the secure enclosure. In either case, the data and control lines for the display are not exposed and cannot be as easily hacked. However, these physical security measures have imposed undesirable physical limitations on mounting locations for these displays. As well, the display cannot be located remotely from the display controller with these solutions because the ribbon cable that connects the display controller to the display would be exposed. The exposed ribbon cable can be easily mounted with a hacking device to display false prompts to a customer.
• Credit card processing companies have recognized and responded to the problem associated with user interfaces at point of sale (POS) systems, such as fuel dispensers, by generating new standards for security at these user interfaces. Applicant hereby incorporates by reference the document “Payment Card Industry (PCI): POS PIN Entry Device Derived Test Requirements,” Version 1.2, dated September, 2004, as if fully set forth herein. These new standards require POS systems to ensure that data sent to the display is not intercepted and replaced with other data. Mechanisms for ensuring the authenticity and proper use of any prompts that are displayed to users of POS systems must be implemented and modification or improper use of the prompts must be prevented. Further, capabilities must be provided for detecting that the display has not been tampered with or removed from its original mounting location. The secure enclosure must be tamper proof and must include tamper detection circuitry. The display data cable that attaches to the display must be protected at the display interface.
• Accordingly, an approach for remotely mounting a display and for providing tamper and removal detection for the display while meeting the new secure processing requirements is needed.
SUMMARY OF THE INVENTION
• The present invention provides tamper detection for a remote display using data integrity operations. A display is attached to a remote secure module and mounted remotely from a display controller. The display controller is enclosed within a secure enclosure. Data to be displayed is processed at the display controller using a data integrity operation, such as a cyclical redundancy check (CRC), to produce a result. The display data is sent to the remote secure module attached to the display. The remote secure module performs the same data integrity operation and returns the result of its data integrity operation to the display controller. The display controller compares the received remote display module's CRC result with the CRC result it generated on the same display data. If the two results do not match, a determination is made that the display has been tampered with or removed. In this manner, fraud associated with the remote display may be detected by the display controller.
• In the event of any damage to or physical separation of either the remote secure module attached to the display or the display itself, the remote secure module will cease transmitting data integrity results back to the display controller. Accordingly, the display controller will be able to detect whether someone has tampered with the display.
• In alternative embodiments, security can be increased by use of multiple data integrity algorithms. Additionally, the selected data bits within a stream of display data upon which the algorithm is performed may be alternated to randomize the process. As well, certain data bits can be time delayed with respect to the algorithm so that they impact the data integrity result out of time sequence. The remote secure module may be instructed with respect to which algorithm to use, which data bits to use, and which bits to delay by transmitting an algorithm selection indication to the remote secure module periodically or with the display data. The algorithm selection may further be communicated to the display as a series of flags or bytes of control or display data in association with signals, such as a vertical sync, a horizontal sync, or a display reset.
• Those skilled in the art will appreciate the scope of the present invention and realize additional aspects thereof after reading the following detailed description of the preferred embodiments in association with the accompanying drawing figures.
BRIEF DESCRIPTION OF THE DRAWINGS
• The accompanying drawing figures incorporated in and forming a part of this specification illustrate several aspects of the invention, and together with the description serve to explain the principles of the invention.
• FIG. 1 illustrates an exemplary embodiment of afuel dispenser10 capable of providing display data integrity for a remote-mounted display;
• FIG. 2 is a block diagram of an exemplary security subsystem that provides remote display tamper detection using data integrity operations for data transmitted for display on a remote-mounted display;
• FIG. 3 is a flow chart illustrating exemplary steps for providing display data integrity for a remote-mounted display;
• FIG. 4 is a flow chart illustrating exemplary steps for providing display data integrity for a remote-mounted display including cyclical redundancy check (CRC) algorithm selection and algorithm options related to the display data;
• FIG. 5 is a flow chart illustrating exemplary steps for providing display data integrity for a remote-mounted display including CRC algorithm selection associated with a vertical sync control signal for the remote display;
• FIG. 6 illustrates an exemplary timing diagram for a generic display that may be used as the remote-mounted display of the present invention; and
• FIG. 7 illustrates exemplary steps for communicating a CRC algorithm selection between a secure module and a remote display security module and for detecting tampering with or removal of a display based upon use of the generic timing diagram ofFIG. 6.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
• The embodiments set forth below represent the necessary information to enable those skilled in the art to practice the invention and illustrate the best mode of practicing the invention. Upon reading the following description in light of the accompanying drawing figures, those skilled in the art will understand the concepts of the invention and will recognize applications of these concepts not particularly addressed herein. It should be understood that these concepts and applications fall within the scope of the disclosure and the accompanying claims.
• Some basic information about afuel dispenser10 is described below before the particular aspects of the present invention are described.FIG. 1 illustrates an exemplary embodiment of thefuel dispenser10 capable of providing display data integrity in a remote-mounted display. Thefuel dispenser10 has abase12 and atop14, with acanopy16 supported by twoside panels18.
• Thefuel dispenser10 is subdivided into multiple compartments. Ahydraulic area20 is used to enclose hydraulic components and anelectronic area22 is used to enclose electronic components. A vapor barrier (not shown) may be used to separate thehydraulic area20 from theelectronic area22.
• Several components used to control fuel flow may be housed within thehydraulic area20. Fuel from underground storage tanks (USTs—not shown) is pumped through a piping network into inlet or fuel dispensing pipes. Aninlet pipe24 provides a piping network from an UST.
• When fuel is dispensed, fuel begins to travel through ameter26, which is responsive to flow rate or volume. Apulser28 is employed to generate a signal in response to fuel movement through themeter26. Adata line30 provides a signaling path from thepulser28 to asecure module32. Thedata line30 provides signals to thesecure module32 indicative of the flow rate or volume of fuel being dispensed within themeter26. Thesecure module32 includes a controller and control circuitry for transaction-level and functional processing within thefuel dispenser10. In addition to transaction-level and functional processing within thefuel dispenser10, thesecure module32 provides security measures that will be described in more detail in association withFIG. 2 following the present high-level description offuel dispenser10 withinFIG. 1.
• Continuing with the description ofFIG. 1, as fuel is dispensed from thefuel dispenser10, thesecure module32 receives signaling from thepulser28 associated with themeter26 described above during the dispensing transaction. In response to receipt of signaling from thepulser28, thesecure module32 provides transaction-level functionality withinfuel dispenser10. Thesecure module32 collects, either directly or indirectly, meter flow measurements associated with themeter26.
• As a dispensing transaction progresses, fuel is then delivered to ahose34 and through anozzle36 into the customer's vehicle (not shown).Fuel dispenser10 includes anozzle boot38, which may be used to hold and retain thenozzle36 when not in use. Thenozzle boot38 may include a mechanical or electronic switch (not shown) to indicate when thenozzle36 has been removed for a fuel dispensing request and when thenozzle36 has been replaced, signifying the end of a fueling transaction. A control line (not shown) provides a signaling path from the electronic switch to thesecure module32. Thesecure module32 uses signaling received via the control line in order to make a determination as to when a transaction has been initiated or completed.
• Thefuel dispenser10 also includes auser interface40 to allow a user/customer to interact with and control a dispenser transaction atfuel dispenser10. Theuser interface40 includes a variety of input and output devices. Theuser interface40 includes a transaction pricetotal display42 that may be used to present the customer with the price to be charged to the customer for fuel. Theuser interface40 also includes a transaction gallontotal display44 that may be used to present the customer with the measurement of fuel dispensed in units of gallons or liters as a volume of fuel dispensed from thefuel dispenser10.
• Thefuel dispenser10 illustrated in the example ofFIG. 1 is a multi-product dispenser that is capable of dispensing different grades of fuel. The price-per-unit (PPU) for each grade of fuel is displayed on displays46.Octane selection buttons48 are provided for the customer to select which grade of fuel is to be dispensed before dispensing is initiated.
• Theuser interface40 also includes adisplay50 that can be used to provide instructions, prompts, and/or advertising or other information to the customer. Customer selections may be made in response to prompts on thedisplay50 by use ofsoft keys52 or keys on akeypad interface54. Thesoft keys52 may be designed to align proximate prompts for the customer to indicate his or her desired choice in response to a question or request. Thefuel dispenser10 may also include acard reader56 that is adapted to receive a magnetic stripe card, such as a credit or debit card, for payment of fuel dispensed. Thefuel dispenser10 may also include other payment or transactional type devices to receive payment information for transaction processing associated with transactions such as a pre-paid dispenser transaction, including abill acceptor58, anoptical reader60, asmart card reader62, and abiometric reader64. Thefuel dispenser10 includes areceipt printer66 so that a receipt with a recording of the dispensing transaction carried out atfuel dispenser10 may be generated and presented to the customer.
• As previously described, thesecure module32 may be used to collect metering measurements from pulsers associated with meters within thefuel dispenser10. Thesecure module32 also controls theuser interface40 during fuel dispensing transactions, such as providing instructions, prompts, etc. to the customer before, during, and after a fueling transaction.
• Thesecure module32 further communicates with a remotedisplay security module68 via a control/data line interface70. The remotedisplay security module68 includes a controller and control circuitry, as will be described in more detail below, for providing display data integrity and tamper detection for thedisplay50 that is part of theuser interface40. The control/data line interface70 may include data and control lines for the display and may also include feedback lines for signaling between thesecure module32 and the remotedisplay security module68 over the control/data line interface70.
• By providing thesecure module32 and the remotedisplay security module68, thefuel dispenser10 can provide tamper and removal detection for thedisplay50 and can satisfy the new standards for security imposed by credit card companies. As will be described in more detail below, data that is sent to thedisplay50 from thesecure module32 can be associated with a data integrity operation and that operation can be repeated at the remotedisplay security module68 to verify that the data has not been tampered with during transmission. Additionally, the remotedisplay security module68 can determine whether the display has been tampered with or removed and can convey that information to thesecure module32 to satisfy the new standards for security.
• FIG. 2 illustrates a block diagram of an exemplary security subsystem that provides remote display tamper detection using data integrity operations for data transmitted for display on a remote-mounted display, such asdisplay50. Theuser interface40 is illustrated, including thedisplay50 remotely mounted and fixedly attached to the remotedisplay security module68. Thedisplay50 may be attached to the remotedisplay security module68 by any means sufficient to form a tamper-proof data interface between thedisplay50 and the remotedisplay security module68.
• Thesecure module32 includes asecure display controller80 that communicates over the control/data line interface70 with the remotedisplay security module68. The bidirectional nature of the control/data line interface70 is illustrated with directional arrows representing the direction of control and data signals for the control/data line interface70. Thesecure display controller80 includes a central processing unit (CPU)82, a transmitdata integrity module84, and a receivedata integrity module86.
• The transmitdata integrity module84 performs a transmit data integrity operation on data that is transmitted to be displayed on thedisplay50. The transmit data integrity operation may include a cyclical redundancy check (CRC) or any other mechanism that can be used for verification of the transmitted data. For example, a data integrity operation may include a mathematical or code based operation, algorithm, and/or acknowledgement that is performed either on the data transmitted or in response that can be repeated between the sender and receiver to ensure that the data transmitted and received are the same. By performing a data integrity operation on data to be displayed, the data can be verified upon receipt at the receivedata integrity module86, as will be described in more detail below, to allow verification that the data has not been tampered with during transmission. Additionally, encryption technologies may be used to further enhance security.
• When data is ready to be transmitted for display on thedisplay50, the transmitdata integrity module84 performs a selected transmit data integrity operation on the data to be displayed. The transmitdata integrity module84 then sends the data to the remotedisplay security module68, where the remotedisplay security module68 can calculate its own data integrity result on the same display data and return the result back to the receivedata integrity module86 for comparison.
• The selected transmit data integrity operation may be changed from time to time to improve security. For example, a CRC calculation may be performed on different portions of the display data or a shift register may be used to delay certain bits within the CRC calculation. Additionally, multiple algorithms may be performed on the same or on different portions of the display data. Other variations in the algorithm to be used are possible and all are considered within the scope of the subject matter described herein. Further, a field within the transmitted data may be used to identify the algorithm or algorithms used for the transmit data integrity operation so that the data may be verified using the same algorithm or algorithms. The algorithm or algorithms identified may include an indication of which portion or portions of the display data are to be operated upon and any other specific operations to be performed on the data, as described above.
• The change in the algorithm may occur randomly or may be periodic. For example, a vertical or horizontal sync signal or a reset signal for thedisplay50 may be used to indicate that the next data transmitted includes an algorithm selection. This algorithm selection may be further included in a separate data stream that itself may be encrypted or verified using a specific or varying integrity check to further increase security. A detailed example of one embodiment of the invention is described below in association withFIGS. 6 and 7.
• The remotedisplay security module68 receives data to be displayed from thesecure module32. The remotedisplay security module68 includes a remotedata integrity module88 that receives the transmitted data. As will be described in more detail below, the remotedata integrity module88 generates its own data integrity result and sends it to thesecure module32. Thesecure module32 then compares the result generated by the remotedata integrity module88 with the one it generated prior to sending the data to the remotedisplay security module68. A mismatch between the two results can provide an indication of fraud in association with the remote display.
• The remotedata integrity module88 may include a CPU or hardware capable of detecting whether thedisplay50 has been tampered with or removed from the remotedisplay security module68. In order to detect tampering with or removal of thedisplay50 from the remotedisplay security module68, the remotedisplay security module68 includes tamper detection circuitry and switches (not shown). The tamper detection circuitry may include circuitry that is coupled to or that is a part of the remotedata integrity module88 that detects signals from tamper detection switches and that processes those signals to determine whether thedisplay50 has been tampered with or removed. Further, the switches may be triggered during a reset or power-down condition and may remain active and be sensed during or in association with a boot sequence after the reset or power-down condition is removed to prevent tampering with or removal of the display during these conditions. The switches may be associated with battery-powered circuitry, for example, or may otherwise provide an appropriate indication that is capable of being sensed in association with the boot sequence after the reset or power-down condition is removed. The tamper detection switches may include plunger switches, proximity switches, or any other type of mechanism that is capable of detecting tampering with or removal of thedisplay50 from its mounting location or from the remotedisplay security module68.
• The remotedata integrity module88 performs the selected data integrity operation on the received data and transmits the result of the data integrity operation to thesecure module32 via the control/data line interface70 as a received data integrity code. In the event of tamper detection, the remotedata integrity module88 will cease transmitting a received data integrity code to thesecure module32. In this way, thesecure module32 will be able to determine that the remote display was removed or tampered with, as will be described in more detail below.
• After receipt of the received data integrity code from the remotedisplay security module68, the receivedata integrity module86 of thesecure module32 compares the received data integrity code with the transmit data integrity code. If the two codes match, the receivedata integrity module86 can notify theCPU82 that the data was properly received at the remotedisplay security module68. If there is not a match, the receivedata integrity module86 can alert theCPU82 that the data was not properly received at the remotedisplay security module68. In this way, data integrity for thedisplay50 can be provided.
• Additionally, because the remotedisplay security module68 includes tamper and removal detection circuitry and the remotedata integrity module88 ceases transmission of a received data integrity code upon detection of tampering or removal of thedisplay50, thesecure module32 can determine that thedisplay50 was either tampered with or removed based upon the absence of receipt of a received data integrity code from the remotedata integrity module88. For example, when the tamper and removal detection circuitry of the remotedisplay security module68 detects an event that indicates that someone has either tampered with or removed thedisplay50, the remotedata integrity module88 ceases sending the receive data integrity code back to thesecure module32. Alternatively, the remotedata integrity module88 could send a separate error code to thesecure module32 to indicate the actual event that has occurred. In either case, thesecure module32 can detect that a problem with the remote display data integrity has occurred. Additionally, problems with the integrity of the control/data line interface70 can also be detected.
• It should be noted that, while thesecure module32 is illustrated with thekeypad interface54 included as part of thesecure module32, this representation is for ease of illustration purposes and is not to be considered limiting.
• FIG. 3 illustrates an exemplary process for providing display data integrity for a remote-mounted display, such as thedisplay50. The process starts atstep302. The process generates a first data integrity result by performing a first data integrity operation on display data to be displayed on the remote display at a secure display controller (step304). For example, thesecure display controller80 can calculate a CRC code by executing a CRC algorithm on data to be transmitted for display on thedisplay50. Further, as described above, the algorithm that is used may be changed occasionally to improve security and an indication of the selected algorithm can be included in association with the display data to be transmitted from thesecure display controller80 to thedisplay50.
• The display data is transmitted from the secure display controller to the remote display security module (step306). For example, thesecure display controller80 can transmit the data to be displayed on thedisplay50 to the remotedisplay security module68.
• The remote display security module receives the display data (step308). A second data integrity result is generated by performing the first data integrity operation on the display data received at the remote display security module (step310). For example, the remotedisplay security module68 can receive the display data and can perform the same CRC calculation that was performed on the display data by thesecure display controller80. Additionally, if an indication of the algorithm to use was received with the display data, the algorithm may be selected from a group of available algorithms.
• A determination is made that the remote display has been tampered with at the secure display controller if the first data integrity result does not match the second data integrity result (step312). For example, if a CRC code is received by thesecure display controller80 from the remotedisplay security module68, thesecure display controller80 can compare the CRC code received from the remotedisplay security module68 with the one generated on the display data sent to the remotedisplay security module68. If the two codes do not match, thesecure display controller80 can determine that someone has tampered with thedisplay50. Further, if a code is not received from the remotedisplay security module68, thesecure display controller80 can also determine that someone has tampered with thedisplay50. In contrast, if the two codes match, thesecure display controller80 can determine that thedisplay50 has not been tampered with and that the control/data line interface70, the remotedisplay security module68, and thedisplay50 are working properly.
• FIG. 4 illustrates an exemplary process for providing display data integrity for a remote-mounted display including CRC algorithm selection and algorithm options related to the display data. The process starts atstep402. A CRC algorithm is selected from a group of CRC algorithms using a CRC identifier (step404). Based upon the selected CRC algorithm, a determination is made as to whether to modify the display data prior to executing the selected CRC algorithm on the display data (decision point406). For example, the selected CRC algorithm may indicate that the display data is to be rotated, shifted or otherwise modified prior to executing the selected CRC algorithm on the display data. The display data is modified as indicated via the selected CRC algorithm (step408).
• Based upon the selected CRC algorithm, a determination is made as to whether all or a portion of the display data is to be used for the CRC calculation (decision point410). For example, the selected CRC algorithm may indicate that only a portion of the display data is to be used for calculation of the CRC for the display data. Further, multiple portions of the display data may be used. These portions may be concatenated, further shifted, or otherwise modified by placement options to arrive at the data to be operated upon with the selected algorithm. In this fashion, the selected algorithm may be executed on any portion of the display data and the selected portion may be dynamically changed based upon the selected algorithm.
• When a determination is made to execute the selected CRC algorithm on the entire display data, the CRC algorithm may be executed on the entire display data (step412). When a determination is made to execute the selected CRC algorithm on a portion of the display data, the CRC algorithm may be executed on the selected portion of the display data, as described above (step414).
• Additionally, a determination may also be made based upon the selected CRC algorithm as to whether to modify the output CRC code prior to transmission of the display data to the remote display security module68 (step416). For example, a two's complement, shifting, or rotation of the CRC code may be done to further enhance security. When a determination is made to modify the output CRC code, this modification can be performed (step418).
• Additionally, the algorithm selection identifier is added to the display data so that it can be transmitted to the remotedisplay security module68 to provide for remote selection of the CRC algorithm that is associated with the data (step420).
• The display data and the algorithm selection identifier are then sent to the remotedisplay security module68 for display (step422). The process then iterates by returning to step404 to process the next display data to be transmitted.
• FIG. 5 illustrates an exemplary process for providing display data integrity for a remote-mounted display including CRC algorithm selection associated with a vertical sync control signal for the remote display. Any control signal or event may be used in place of the vertical sync signal. For example, a reset signal or horizontal sync signal may also be used. The process starts atstep502.
• A determination is made as to whether to issue a vertical sync signal to the remote display, such as display50 (step504). Upon determining that a vertical sync signal is to be generated for the remote display, a CRC algorithm is selected from a group of CRC algorithms (step506). The CRC algorithms may be chosen randomly or may be chosen in a sequential or round robin fashion. Additionally, the CRC algorithms may be chosen by bit fields within the data stream itself. For example, if four algorithms are to be used, two bits within any portion of the display data may be used to select the algorithm. Further, the bits used to select the algorithm may be changed over time. Accordingly, as the display data changes, the algorithm selected may be changed based upon the display data.
• The selected algorithm is executed on the display data (step508). Any of the alternatives described in relation toFIG. 4 can be implemented as part of the execution of the CRC algorithm. The algorithm selection identifier is added to the display data so that it can be transmitted to the remote display security module68 (step510). As described above, the display data itself may be used to select the algorithm.
• The display data and the algorithm selection identifier are then sent to the remotedisplay security module68 for verification and display (step512). The process then iterates by returning to step504 to process the next display data to be transmitted.
• FIG. 6 illustrates an exemplary timing diagram for a generic display that may be used as the remote-mounteddisplay50 above and inFIG. 5 in particular. A vertical sync (Vsync) signal602 is shown as an active-low signal withactive regions604 and606. The Vsync signal is used to indicate the beginning of a display update cycle for a display, such as thedisplay50.
• A horizontal sync (Hsync) signal608 is used to identify regions of data associated with horizontal regions of thedisplay50. Apre-data period610, adata period612, and apost-data period614 are illustrated. During thepre-data period610 and thepost-data period614, no data is passed to thedisplay50. Accordingly, as will be described in more detail below, these regions may be used to communicate CRC algorithm selection information. Alternatively, the CRC algorithm selection may be passed within and/or selected by the display data duringdata period612.
• Thedata period612 is expanded below theHsync signal608 withinFIG. 6. An active-high data enable (DE) signal616 is illustrated. During thedata period612, the DE signal616 activates for each data set that is presented to thedisplay50. ExemplaryDE signal pulses618,620 and622 are illustrated.
• Adata buss624 passes display data to thedisplay50 for red, green and blue color variants. The fields for red (e.g., R0-RZ), green (e.g., G0-GZ), and blue (e.g., B0-BZ) can be, for example, six (6) bits for each field yielding a data buss width for thedata buss624 of eighteen (18) bits. Other variations on buss width and color field widths for a data buss, such asdata buss624, are possible and all are considered within the scope of the subject matter described herein.
• Adata segment626 passes display data for the first row of thedisplay50 that is to be written during theDE signal pulse618. Adata segment628 passes display data for the row of thedisplay50 that is to be written during theDE signal pulse620. Adata segment630 passes display data for the last row of thedisplay50 that is to be written during theDE signal pulse622.
• For purposes of illustration, it will be assumed that the top row of thedisplay50 is to be written first and that the bottom row is to be written last. Accordingly,data segment626 represents data that is to be written to the top row of thedisplay50 anddata segment630 represents data that is to be written to the bottom row of thedisplay50. An independent variable “Y” is used withinFIG. 6 to represent the row identifier for the respective data segment that is written to thedisplay50. The independent variable is shown withinFIG. 6 to vary between zero (0) and “Y_Max.” The maximum value of Y can be, for example, four hundred seventy nine (479) for a display with a resolution of 640×480 pixels, where 480 rows of pixels are present for the display of data and the first row is identified by a zero (0).
• An independent variable “X” is used withinFIG. 6 to identify the pixel within a row that is to be written with data. Accordingly, an identifier D(X,Y) is associated withdata segment628 that occurs during theDE signal pulse620. Likewise, an identifier D(X,0) that is associated with thedata segment626 during theDE signal pulse618 and an identifier D(X, Y_Max) that is associated with thedata segment630 during theDE signal pulse622.
• TheDE signal pulse620 and thedata segment628 ofdata buss624 are expanded below the expandeddata period612 withinFIG. 6. As can be seen fromFIG. 6,data segments632,634, and636 are represented. Identifiers associated with thedata segments632,634, and636 are D(0, Y), D(1, Y), and D(X_Max, Y), respectively. For the example of a 640×480 display, the value of X can range between zero (0) and six hundred thirty nine (639). Data can be latched during any data segment by a data clock (not shown). Accordingly, for any display write period, such asdata period612, all pixels within the display can be written by varying the values of the independent variables X and Y across the display.
• As described above, the data values that are written to the display can be used to select a CRC algorithm. This algorithm selection may be performed on a pixel-by-pixel basis or may be performed for an entire display sequence, such asdata period612, by the data within a data segment, such as the first data segment (e.g., D(0,0)—not shown withinFIG. 6). In this way, the CRC algorithm selection can be performed at the beginning of a display sequence, such asdata period612, and can be used during the entire display update sequence. Alternatively, the CRC algorithm selection can be performed at the end of a display sequence or during any intermediate data segment and can be effective until changed. Because the DE signal616 is active during display data write periods, the DE signal616 may be used to gate the display data during the CRC algorithm selection period. Further, pulses of the DE signal616, such as theDE signal pulse618, may be counted to adjust which display data segment will be used to identify the CRC algorithm. The change in the CRC algorithm can be randomized or varied over time to further enhance security.
• Alternatively, the CRC algorithm selection can be performed during time periods that are not associated with active display data transmission, such as during thepre-data period610 and thepost-data period614. The CRC algorithm selection may be based upon the display data. For example, a register may be used to capture a certain portion of the display data and this data may be multiplexed onto thedata buss624 during a third Hsync pulse after a rising edge of the Vsync signal. Other locations for communication of the CRC algorithm selection are possible. Further, the portion of the display data captured and multiplexed onto thedata buss624 may be randomized and otherwise varied over time.
• As yet another alternative, the CRC algorithm selection can be performed independently of the display data during these time periods that are not associated with active display data transmission. Equation-based manipulations may be used to select a CRC algorithm. For example, a modulus operation may be performed on a fixed width bit field within a register on each subsequent display data update. The result of the modulus operation may be used to select the CRC algorithm from a set of CRC algorithms. The CRC algorithm identifier may then be transmitted during these time periods that are not associated with active display data transmission.
• Again, any number of bits may be used to select the CRC algorithm and the algorithm selection may further be performed over multiple data values to further expand the number of possible CRC algorithm permutations that may be used. Accordingly, the equation used or the bit field width may be changed over time.
• FIG. 7 illustrates an exemplary process for communication of a CRC algorithm selection between thesecure module32 and the remotedisplay security module68 and for detecting tampering with or removal of a display based upon use of the generic timing diagram ofFIG. 6.FIG. 7 illustrates two sub-processes that work together. The left portion ofFIG. 7 represents processing that takes place on the display data transmit side, such as at thesecure module32. The right portion ofFIG. 7 represents processing that takes place on the display data receive side, such as at the remotedisplay security module68. The control/data line interface70 may be used to communicate between thesecure module32 and the remotedisplay security module68.
• Display data and sync signals are generated (step700). The display data and sync signals are received at the transmitdata integrity module84 within thesecure module32 and at the remotedata integrity module88 within the remote display security module68 (steps702 and704, respectively). A determination is made as to whether a Vsync signal has been received at the transmitdata integrity module84 and at the remote data integrity module88 (steps706 and708, respectively). If a vertical sync was received at the two modules, a CRC algorithm may be changed (steps710 and712, respectively) based upon the subsequent display data that is received. Alternatively, the CRC algorithm may remain the same and can be changed by any other relationship of display interface signals described above. A CRC code is generated for the transmitted data (step714) and the process waits for a CRC result to be received (step716).
• A determination is made as to whether the display has been tampered with or removed (step718). If a determination is made that the display has been tampered with or removed, the process stops generating CRC codes at the remote display security module68 (step720). By ceasing generation of the CRC codes at the remotedisplay security module68, thesecure module32 will be able to determine that thedisplay50 has been tampered with or removed. If a determination is made that the display has not been tampered with or removed, the process generates a CRC code at the remote display security module68 (step722). The process then sends the result back to the secure module32 (step724).
• Receipt of a CRC code at the secure module32 (step716) allows the process to compare the received CRC code with the transmitted CRC code (step726). A determination is then made as to whether the CRC results match (step728). If the two results do not match, the CPU is notified of an intrusion (step730). It should also be noted, that the process described can also detect other problems, such as a problem with the integrity of the control/data line interface70. If the two results match, the process returns to generate display data and syncs for the next display update sequence (step700).
• Those skilled in the art will recognize improvements and modifications to the preferred embodiments of the present invention. All such improvements and modifications are considered within the scope of the concepts disclosed herein and the claims that follow.

Claims (33)

1. A method for detecting tampering of a remote display having an associated remote display security module, comprising the steps of:

generating at a secure module a first data integrity result by performing a first data integrity operation on display data to be displayed on the remote display;

transmitting the display data from the secure module to the remote display security module;

receiving at the remote display security module the display data;

generating a second data integrity result at the remote display security module by performing the first data integrity operation on the received display data; and

determining that the remote display has been tampered with at the secure module if the first data integrity result does not match the second data integrity result.

2. The method ofclaim 1 wherein the step of determining if the first data integrity result does not match the second data integrity result comprises not receiving the second data integrity result at the secure module.

3. The method ofclaim 1 further comprising displaying the display data on the remote display.

4. The method ofclaim 3 wherein the step of displaying the display data is performed at the remote display security module.

5. The method ofclaim 1 further comprising monitoring a tamper detection switch at the remote display security module.

6. The method ofclaim 5 comprising determining that the remote display has been tampered with at the remote display security module by sensing a signal from the tamper detection switch indicating that the remote display has been tampered with.

7. The method ofclaim 6 wherein the remote display security module senses the signal from the tamper detection switch indicating that the remote display has been tampered with in association with a boot sequence for the remote display security module after at least one of a reset and a power-down condition at the remote display security module.

8. The method ofclaim 5 wherein the tamper detection switch is selected from a group consisting of a plunger switch and a proximity switch.

9. The method ofclaim 1 wherein the first data integrity operation includes calculating a cyclical redundancy check (CRC) on the display data.

10. The method ofclaim 8 wherein the CRC is calculated on a fixed portion of the display data.

11. The method ofclaim 8 wherein the CRC is calculated on a varying portion of the display data.

12. The method ofclaim 8 wherein the CRC is calculated by delaying at least one bit of the display data.

13. The method ofclaim 1 wherein the first data integrity operation is selected from a plurality of data integrity operations.

14. The method ofclaim 1 wherein the first data integrity operation is selected in association with a control signal asserted to the remote display.

15. The method ofclaim 1 further comprising sending an indication identifying the first data integrity operation within a plurality of data integrity operations to the remote display security module.

16. The method ofclaim 14 wherein the indication identifying the first data integrity operation is sent to the remote display security module at a time other than when the display data is sent to the remote display security module.

17. The method ofclaim 1 wherein at least a portion of the display data is used to select the first data integrity operation within a plurality of data integrity operations.

18. A system for detecting tampering of a remote display having an associated remote display security module, comprising the steps of:

a secure module adapted to:

generate a first data integrity result by performing a first data integrity operation on display data to be displayed on the remote display;

transmit the display data to the remote display security module; and

determine that the remote display has been tampered with if the first data integrity result does not match a second data integrity result; and

a remote display security module adapted to:

receive the display data; and

generate the second data integrity result by performing the first data integrity operation on the display data received at the remote display security module.

19. The system ofclaim 18 wherein the secure module is further adapted to determine if the first data integrity result does not match the second data integrity result when the second data integrity result is not received.

20. The system ofclaim 18 wherein the remote display security module is further adapted to display the display data on the remote display.

21. The system ofclaim 18 wherein the remote display security module is further adapted to monitor a tamper detection switch.

22. The system ofclaim 21 wherein the remote display security module is further adapted to determine that the remote display has been tampered with by sensing a signal from the tamper detection switch indicating that the remote display has been tampered with.

23. The system ofclaim 22 wherein the remote display security module is further adapted to sense the signal from the tamper detection switch indicating that the remote display has been tampered with in association with a boot sequence for the remote display security module after at least one of a reset and a power down condition at the remote display security module.

24. The system ofclaim 21 wherein the tamper detection switch is selected from a group consisting of a plunger switch and a proximity switch.

25. The system ofclaim 18 wherein the secure module and the remote display security module are adapted to perform the first data integrity operation by calculating a cyclical redundancy check (CRC) on the display data.

26. The system ofclaim 25 wherein the secure module and the remote display security module are adapted to calculate the CRC on a fixed portion of the display data.

27. The system ofclaim 25 wherein the secure module and the remote display security module are adapted to calculate the CRC on a varying portion of the display data.

28. The system ofclaim 25 wherein the secure module and the remote display security module are adapted to calculate the CRC by delaying at least one bit of the display data.

29. The system ofclaim 18 wherein the first data integrity operation comprises at least one of a plurality of data integrity operations.

30. The system ofclaim 18 wherein the secure module is adapted to select the first data integrity operation in association with assertion of a control signal to the remote display.

31. The system ofclaim 18 wherein the secure module is adapted to send an indication identifying the first data integrity operation comprising at least one of a plurality of data integrity operations to the remote display security module.

32. The system ofclaim 31 wherein the secure module is adapted to send the indication identifying the first data integrity operation comprising at least one of a plurality of data integrity operations to the remote display security module at a time other than when the display data is sent to the remote display security module.

33. The system ofclaim 18 wherein the secure module and the remote display security module are further adapted to use at least a portion of the display data to select the first data integrity operation within a plurality of data integrity operations.

Images